SQL Injection

GSF is vulnerable to SQL Injection attacks. It does not set the allowSelect argument of ParseInputMeasurementKeys function to null and does not remove the mrequestedInputFilter setting before callingbase.Initialize. This can allow a malicious user to inject and execute arbitrary SQL queries...

Null pointer dereference

An error within the "tardirectoryforfile" function gsf-infile-tar.c in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause a crash via a crafted TAR file...